#193: pond purge (retention job + manual Site-Admin endpoint) #248

fable-5 · 2026-07-30T12:45:10+02:00

fable-5 commented

2026-07-30 12:45:10 +02:00

Implements #193:

Retention path: the existing daily trash-purge job now also purges ponds past the trash retention (same trash.retentionDays clock as pages).
Manual path: DELETE /ponds/:id/purge, Site-Admin-only (the pond trash is a Site-Admin surface, like restore). 404 for live/unknown ponds, idempotent (a second purge or a race with restore is a clean no-op).
Sequence: attachment files first (idempotent rm, resumable after a crash), then ONE transaction ordered around the FK actions - attachments/labels (Restrict) before the pond; page delete cascades versions, comments, content cache incl. search vector, update log, mentions, label assignments, favorites, outgoing links, open collab sessions; pond delete cascades grants, usage counters (= the quota correction), pond-plugin opt-ins, conversion jobs; polymorphic watches (page+pond) and pond quota overrides deleted explicitly.
Both paths record a pond.purged audit event (trigger manual/retention, page and attachment counts).
Known residues by design (documented in operations.md): page_links.target_slug in OTHER ponds pages (#235) and backups within their retention.

Tested: new pond-purge.e2e.db.test.ts proves nothing referencing the pond survives (14 table assertions + file on disk + search before/after via a real tsvector), guard behaviour (live pond 404, non-admin 403), idempotence, and the retention path incl. audit events; api full suite green vs fresh DB; typecheck + lint green. No UI change (the pond trash has no web UI today).

Refs #193 (close manually after green CI + merge).

Generated with Claude Code (Claude Fable 5)

Implements #193: - Retention path: the existing daily trash-purge job now also purges ponds past the trash retention (same trash.retentionDays clock as pages). - Manual path: DELETE /ponds/:id/purge, Site-Admin-only (the pond trash is a Site-Admin surface, like restore). 404 for live/unknown ponds, idempotent (a second purge or a race with restore is a clean no-op). - Sequence: attachment files first (idempotent rm, resumable after a crash), then ONE transaction ordered around the FK actions - attachments/labels (Restrict) before the pond; page delete cascades versions, comments, content cache incl. search vector, update log, mentions, label assignments, favorites, outgoing links, open collab sessions; pond delete cascades grants, usage counters (= the quota correction), pond-plugin opt-ins, conversion jobs; polymorphic watches (page+pond) and pond quota overrides deleted explicitly. - Both paths record a pond.purged audit event (trigger manual/retention, page and attachment counts). - Known residues by design (documented in operations.md): page_links.target_slug in OTHER ponds pages (#235) and backups within their retention. Tested: new pond-purge.e2e.db.test.ts proves nothing referencing the pond survives (14 table assertions + file on disk + search before/after via a real tsvector), guard behaviour (live pond 404, non-admin 403), idempotence, and the retention path incl. audit events; api full suite green vs fresh DB; typecheck + lint green. No UI change (the pond trash has no web UI today). Refs #193 (close manually after green CI + merge). Generated with Claude Code (Claude Fable 5)

fable-5 added 1 commit 2026-07-30 12:45:11 +02:00

#193 : pond purge — retention job and manual Site-Admin endpoint

CI / Lint, typecheck, test (pull_request) Successful in 4m58s

Details

CI / Build container images (pull_request) Successful in 2m47s

Details

CI / Auth e2e pack (pull_request) Successful in 7m46s

Details

CI / Import/export fidelity gate (pull_request) Successful in 56s

Details

CD / Build and push images (push) Successful in 19s

Details

CD / Deploy to Test (push) Successful in 28s

Details

CD / Smoke tests against Test (push) Successful in 1m20s

Details

CD / Promote to Int (push) Successful in 12s

Details

CI / Lint, typecheck, test (push) Successful in 5m4s

Details

CI / Build container images (push) Has been skipped

Details

CI / Auth e2e pack (push) Successful in 7m38s

Details

CI / Import/export fidelity gate (push) Successful in 56s

Details

402b22e05f

Deletion now actually deletes: a trashed pond past the trash retention
(same clock as pages, extended trash-purge job) or purged manually via
DELETE /ponds/:id/purge (Site-Admin-only, like pond restore) is removed
with everything it holds. Files go first (idempotent rm, resumable on a
crash), then one transaction ordered around the FK actions: attachments
and labels (Restrict) precede the pond; the page delete cascades
versions, comments, content cache incl. the search vector, update log,
mentions, label assignments, favorites, outgoing links and open collab
sessions; the pond delete cascades grants, usage counters (that is the
quota correction), pond-plugin opt-ins and conversion jobs; polymorphic
watches and pond quota overrides are deleted explicitly. A purge racing
a restore or another purge is a no-op; both paths record a pond.purged
audit event.

Known residues by design, documented in operations.md: target_slug in
other ponds' page links (#235) and backups within their retention.

Refs #193

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

fable-5 merged commit 402b22e05f into main

2026-07-30 12:59:52 +02:00

fable-5 referenced this pull request

2026-07-30 12:59:53 +02:00

[VS-NfD] Implement pond purge #193

Sign in to join this conversation.

No reviewers